Cryptographic governance evidence for Meta Llama deployments. The open-weight compliance gap, solved.
Who this is for: Developers and compliance officers deploying Meta Llama models (Llama 3.x, Llama 4) in production. No adapter required. Works with vLLM, Ollama, TGI, SGLang, LiteLLM, and any OpenAI-compatible serving framework.
EU AI Act GPAI obligations enforce August 2, 2026. Open-weight deployers bear full compliance responsibility. Meta distributes the weights. You own the evidence. Every Llama inference without a governance record is a liability gap that grows with each request.
Meta releases Llama model weights under the Llama Community License Agreement. This means anyone can download, fine-tune, and deploy the model. It also means that Meta cannot provide compliance attestation for how you use their model.
This is not a gap in Meta's product. It is the fundamental architecture of open-weight AI.
Under the EU AI Act, deployers of GPAI models are responsible for demonstrating compliance with transparency, risk management, and post-market monitoring obligations. When you deploy Llama, you are the deployer. Meta is the provider of the weights, not the provider of your AI system.
SWT3 fills this gap. It provides independent, cryptographic evidence that governance controls were active during every inference. The Witness Anchor exists outside Meta's infrastructure, outside your serving framework, and outside any single cloud provider. It is a third-party attestation record that proves what happened, when, and under what controls.
Llama models are served through a variety of frameworks. All major serving frameworks expose an OpenAI-compatible API. This means SWT3 witnessing works identically across all of them, with zero framework-specific code.
| Serving Framework | API Compatibility | SWT3 Integration |
|---|---|---|
| vLLM | OpenAI-compatible (/v1/chat/completions) | wrap(OpenAI(base_url=...)) |
| Ollama | OpenAI-compatible (/v1/chat/completions) | wrap(OpenAI(base_url=...)) |
| TGI (Text Generation Inference) | OpenAI-compatible (/v1/chat/completions) | wrap(OpenAI(base_url=...)) |
| SGLang | OpenAI-compatible (/v1/chat/completions) | wrap(OpenAI(base_url=...)) |
| LiteLLM | 100+ provider routing, OpenAI-compatible | wrap(litellm_client) |
| llama.cpp | OpenAI-compatible server mode | wrap(OpenAI(base_url=...)) |
Every serving framework in this table produces identical SWT3 Witness Anchors. The anchor records the model, the input hash, the output hash, and the governance context. The serving framework is transparent to the evidence chain.
When upgrading from one Llama version to another (for example, Llama 3.1 to Llama 4), the SWT3 lifecycle chain creates an auditable record of the transition. The AI-ASSESS.1 procedure links the old and new model versions in a single chain, providing evidence of champion-challenger assessment.
Open-weight models can be modified after download. AI-MDL.1 records the SHA-256 hash of the model weights file, proving which exact version is deployed. If the weights change (fine-tuning, corruption, or tampering), the hash changes and the next Witness Anchor reflects the new state.
| Level | Use Case | What Is Retained |
|---|---|---|
| Level 0 (Analytics) | Internal benchmarking, model evaluation, development | Model ID, latency, verdict. Prompt and response hashes stripped. |
| Level 1 (Standard) | Production inference, general-purpose Llama deployments | Full anchor: model, prompt hash, response hash, latency, agent ID. Default for most deployments. |
| Level 2 (Sensitive) | Healthcare, PII workloads, financial services with customer data | Full anchor plus jurisdiction, legal basis, and purpose class (CJT fields). Required for GDPR-regulated workloads. |
| Level 3 (Classified) | Defense, air-gapped environments, national security applications | Full anchor with offline attestation. No network egress. Anchors stored locally and synced via axiom pulse. |
Clearing levels are set per-witness instance. A single deployment can run multiple witness instances at different clearing levels for different workload types.
Under the EU AI Act, Llama qualifies as a General-Purpose AI (GPAI) model. Meta, as the provider, has obligations around technical documentation and transparency. But when you deploy Llama into a specific use case, you become the deployer, and additional obligations apply to you.
| EU AI Act Article | Obligation | SWT3 Evidence |
|---|---|---|
| Art. 53 | Technical documentation for GPAI models | AI-INF.1 anchors provide inference-level technical records. AI-MDL.1 proves model version and weights integrity. Combined with the SWT3 ledger, this creates the deployer's technical documentation layer. |
| Art. 50 | Transparency obligations | Every Witness Anchor is independently verifiable at sovereign.tenova.io/verify. The anchor format, fingerprint formula, and verification algorithm are public. Transparency is structural, not declarative. |
| Art. 9 | Risk management system | AI-GRD.1 proves guardrails were active. AI-FAIR.1 records bias measurement. AI-DRIFT.2 captures consequence-mapped drift thresholds. These procedures create continuous risk management evidence, not point-in-time assessments. |
| Art. 72 | Post-market monitoring | The SWT3 ledger is a continuous post-market monitoring record. Every inference is witnessed. Drift detection (AI-DRIFT.2) and model assessment (AI-ASSESS.1) provide ongoing evidence of monitoring activity. |
For the full EU AI Act compliance checklist, see EU AI Act August 2026 Checklist. For GPAI Code of Practice mapping, see GPAI Code of Practice Mapping.
Open-weight context: When you self-host Llama, there is no third-party API provider recording your inferences. Your serving framework (vLLM, Ollama, TGI) processes requests and returns responses. Without SWT3, there is no independent record that any inference occurred.
SWT3 witnesses: Every inference produces a Witness Anchor recording the model identifier, SHA-256 hashes of the input and output, execution latency, and the serving endpoint. The anchor is minted independently of the serving framework and exists as a verifiable, immutable record.
AI-INF.1 anchors prove that a specific Llama model processed a specific input at a specific time. The prompt and response hashes allow correlation with your application logs without exposing the actual content. Verify any anchor at sovereign.tenova.io/verify.
Open-weight context: Llama weights are downloaded from Hugging Face, Meta's distribution portal, or mirrored internally. Fine-tuned variants may diverge from the original weights. Without a cryptographic record, there is no way to prove which version of the model is actually running in production.
SWT3 witnesses: The hash_model_file() utility computes a SHA-256 hash of the weights file. The AI-MDL.1 anchor records this hash alongside the model identifier, source, and version. Any modification to the weights produces a different hash, creating an automatic integrity signal.
AI-MDL.1 anchors prove model provenance. Compare the recorded weights hash against the published hash from Meta or Hugging Face to verify the model has not been modified. For fine-tuned models, the hash establishes a new baseline that can be tracked across deployments.
Open-weight context: Closed-model providers embed guardrails in their API. When you deploy Llama, guardrail implementation is entirely your responsibility. Llama Guard, custom filters, content classifiers: whatever you choose, you must prove it was active during every inference.
SWT3 witnesses: The anchor records whether guardrails were active and whether they passed or failed for each inference. This creates a continuous record of safety control status, independent of the guardrail implementation itself.
AI-GRD.1 evidence shows guardrailsActive = true and guardrailPassed = true/false for every witnessed inference. A pattern of guardrailsActive = false indicates inferences running without safety controls. This is the deployer's responsibility for open-weight models.
Open-weight context: Llama releases new versions regularly. Upgrading from Llama 3.1 to Llama 4 requires evaluation, testing, and a deliberate promotion decision. Without a governance record, there is no evidence that a structured assessment occurred before the swap.
SWT3 witnesses: The lifecycle chain links the champion (current model) and challenger (candidate model) in a single auditable sequence. The AI-ASSESS.1 anchor records the evaluation dataset, decision outcome, and timestamp, proving that the upgrade followed a governed process.
AI-ASSESS.1 lifecycle chains show the full history of model transitions. Each chain links the old and new model versions with the assessment decision. This satisfies Art. 9 risk management requirements for model updates and Art. 72 post-market monitoring for version changes.
Open-weight context: Meta publishes model cards with aggregate bias metrics. These metrics describe the base model, not your deployment. If you fine-tune Llama on your own data, the bias profile changes. If you deploy Llama for a specific population, the impact profile changes. The base model card does not cover your use case.
SWT3 witnesses: AI-FAIR.1 anchors record bias measurement results from your deployment context. This creates deployer-specific fairness evidence that supplements (not replaces) Meta's model card.
AI-FAIR.1 anchors prove that bias was measured in your specific deployment context, with your data, for your population. This is distinct from Meta's model card and satisfies the deployer's obligation under Art. 9 to assess risks in the intended use context.
| Examiner Question | Where to Look |
|---|---|
| Which Llama version is deployed? | AI-MDL.1 anchor: model_id and weights_hash. Compare hash against published weights from Meta or Hugging Face. |
| Can you prove every inference was governed? | AI-INF.1 anchors in the SWT3 ledger. One anchor per inference. Continuous, not sampled. |
| Were guardrails active? | AI-GRD.1 fields: guardrailsActive and guardrailPassed. Any gap in guardrail coverage is visible. |
| How was the model upgrade assessed? | AI-ASSESS.1 lifecycle chain. Links old and new model versions with assessment decision and evaluation dataset. |
| Is this evidence independent of Meta? | Every SWT3 Witness Anchor is verifiable at sovereign.tenova.io/verify. SHA-256 fingerprints exist outside Meta's infrastructure. |
| Does this work with our serving framework? | Yes. vLLM, Ollama, TGI, SGLang, LiteLLM, llama.cpp. Any OpenAI-compatible endpoint. Zero framework-specific code. |
| What about fine-tuned models? | AI-MDL.1 records the hash of your fine-tuned weights. AI-FAIR.1 records bias metrics for your specific model variant. |
Full SDK documentation: sovereign.tenova.io/docs
Create a free account: sovereign.tenova.io/signup